forked from QubesOS/qubes-builder-debian
-
Notifications
You must be signed in to change notification settings - Fork 0
/
prepare-chroot-qubuntu
executable file
·132 lines (114 loc) · 5.61 KB
/
prepare-chroot-qubuntu
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
#!/bin/bash
# vim: set ts=4 sw=4 sts=4 et :
if [ "$VERBOSE" -ge 2 -o "$DEBUG" == "1" ]; then
set -x
fi
# ------------------------------------------------------------------------------
# Configuration
# $1: chroot directory [chroot-trusty ]
# $2: distribution [trusty ]
# ------------------------------------------------------------------------------
DIR=$1
DISTRO=$2
set -e
# ------------------------------------------------------------------------------
# Build packages to be installed to allow building of Qubes modules
# ------------------------------------------------------------------------------
BUILDPACKAGES="reprepro build-essential devscripts git git-buildpackage pbuilder debhelper quilt libxen-dev python libpulse-dev libtool automake xorg-dev xutils-dev libxdamage-dev libxcomposite-dev libxt-dev libx11-dev"
if [ "0${BUILDER_TURBO_MODE}" -gt 0 ]; then
APT_GET_OPTIONS+=" -o Dpkg::Options::=--force-unsafe-io"
eatmydata_maybe=eatmydata
fi
APT_GET_OPTIONS+=" -o Acquire::Retries=3"
if [ -n "${REPO_PROXY}" ]; then
APT_GET_OPTIONS+=" -o Acquire::http::Proxy=${REPO_PROXY}"
DEBOOTSTRAP_PREFIX+=" env http_proxy=${REPO_PROXY}"
fi
INITIAL=
if ! [ -d $DIR/home/user ]; then
# --------------------------------------------------------------------------
# Install qubuntu choot if /home/user does not exist (initial run)
# --------------------------------------------------------------------------
INITIAL=1
mkdir -p $DIR
echo "-> Installing qubuntu build chroot..."
COMPONENTS="" $DEBOOTSTRAP_PREFIX debootstrap --arch=amd64 \
--include=ncurses-term,ubuntu-keyring,$eatmydata_maybe \
--keyring=${DEBIAN_PLUGIN_DIR}/keys/$DIST-qubuntu-archive-keyring.gpg \
$DEBIANVERSION $DIR http://archive.ubuntu.com/ubuntu \
|| { echo "Error in debootstrap"; exit 1; }
# --------------------------------------------------------------------------
# Set up a temporary policy-rc.d to prevent apt from starting services
# on package installation
# --------------------------------------------------------------------------
cat > $DIR/usr/sbin/policy-rc.d <<EOF
#!/bin/sh
return 101 # Action forbidden by policy
EOF
chmod 755 $DIR/usr/sbin/policy-rc.d
# --------------------------------------------------------------------------
# Add some groups and users
# --------------------------------------------------------------------------
[ -n "$SUDO_UID" ] && USER_OPTS="-u $SUDO_UID"
[ -n "$USER_UID" ] && USER_OPTS="-u $USER_UID"
# Added -f to ignore if group already exists
if [ -n "$USER_GID" ]; then
chroot $DIR groupadd -f -g $USER_GID user
elif [ -n "$SUDO_GID" ]; then
chroot $DIR groupadd -f -g $SUDO_GID user
else
chroot $DIR groupadd user
fi
chroot $DIR sh -c "useradd -g user $USER_OPTS -m user;su -c 'mkdir qubes-src' - user"
# --------------------------------------------------------------------------
# /dev/null should be 0666
# --------------------------------------------------------------------------
chroot $DIR sh -c "chmod 0666 /dev/null"
else
# --------------------------------------------------------------------------
# /home/user directory already exists, so above stage already complete so
# temporary remove builder repo, it will be recreated at the end of this
# script
# --------------------------------------------------------------------------
rm -f $DIR/etc/apt/sources.list.d/qubes-builder.list
# update chroot
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y upgrade
fi
# ------------------------------------------------------------------------------
# Mount /proc within chroot environment
# ------------------------------------------------------------------------------
if ! [ -r $DIR/proc/cpuinfo ]; then
mount -t proc proc $DIR/proc
fi
# ------------------------------------------------------------------------------
# Add universe to sources.list
# ------------------------------------------------------------------------------
sed -i "s/${DIST} main$/${DIST} main universe/g" $DIR/etc/apt/sources.list
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
# ------------------------------------------------------------------------------
# Install all build packages specified
# ------------------------------------------------------------------------------
chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y install $BUILDPACKAGES
if [ $DIST = trusty ]; then
# Install pulseaudio5
chroot $DIR apt-get $APT_GET_OPTIONS install -y software-properties-common
chroot $DIR add-apt-repository -y ppa:ubuntu-audio-dev/pulse-testing
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
fi
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
chroot $DIR apt-get $APT_GET_OPTIONS install -y libpulse-dev
# ------------------------------------------------------------------------------
# Update qubuntu apt sources list to use local qubes repo
# ------------------------------------------------------------------------------
cat > $DIR/etc/apt/sources.list.d/qubes-builder.list <<EOF
deb [trusted=yes] file:/tmp/qubes-deb $DEBIANVERSION main
EOF